The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4211 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

    * kernel: ovl: fix leaked entry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

    * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

    * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

    * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

    * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

    * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10]     (CVE-2024-27397)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

    * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

    * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804,     CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:RHEL-29783)

    * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:RHEL-35361)

    * RHEL8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:RHEL-36048)

    * [RHEL8] blktests block/024 failed (JIRA:RHEL-8130)

    * RHEL8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:RHEL-14195)

    * Latency spikes with Matrox G200 graphic cards (JIRA:RHEL-36172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to     host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.
    (CVE-2023-5090)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12911 advisory.

    - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky)       [Orabug: 35857366]  {CVE-2023-5090}
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)     [Orabug: 35824287]  {CVE-2023-42753}
    - x86/microcode: Stop reprobing mitigations after late microcode load (Boris Ostrovsky)  [Orabug:
    35818857]  {CVE-2023-20569}
    - objtool/x86: Fix SRSO mess (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Correct the mitigation status when SMT is disabled (Borislav Petkov (AMD))  [Orabug: 35818857]     {CVE-2023-20569}
    - objtool/x86: Fixup frame-pointer vs rethunk (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Disable the mitigation on unaffected configurations (Borislav Petkov (AMD))  [Orabug:
    35818857]  {CVE-2023-20569}
    - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Sean Christopherson)  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/srso: Explain the untraining sequences a bit more (Borislav Petkov (AMD))  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/cpu: Cleanup the untrain mess (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/cpu: Rename original retbleed methods (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/cpu: Clean up SRSO return thunk mess (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/alternative: Make custom return thunk unconditional (Peter Zijlstra)  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Peter Zijlstra)  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/cpu: Fix __x86_return_thunk symbol type (Peter Zijlstra)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Fix build breakage with the LLVM linker (Nick Desaulniers)  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/srso: Tie SBPB bit setting to microcode patch detection (Borislav Petkov (AMD))  [Orabug: 35818857]     {CVE-2023-20569}
    - x86/srso: Fix return thunks in generated code (Josh Poimboeuf)  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Add IBPB on VMEXIT (Borislav Petkov (AMD))  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Add SRSO_NO support (Borislav Petkov (AMD))  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Add IBPB_BRTYPE support (Borislav Petkov (AMD))  [Orabug: 35818857]  {CVE-2023-20569}
    - x86/srso: Add a Speculative RAS Overflow mitigation (Borislav Petkov (AMD))  [Orabug: 35818857]     {CVE-2023-20569}
    - rds: Fix lack of reentrancy for connection reset with dst addr zero (Hakon Bugge)  [Orabug: 35819522]     {CVE-2023-22024}
    - x86/CPU/AMD: Fix the DIV(0) initial fix attempt (Borislav Petkov (AMD))  [Orabug: 35776936]     {CVE-2023-20588}
    - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Borislav Petkov (AMD))  [Orabug: 35776936]     {CVE-2023-20588}
    - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma)   {CVE-2023-3772}
    - net: tap_open(): set sk_uid from current_fsuid() (Laszlo Ersek)   {CVE-2023-1076}
    - net: tun_chr_open(): set sk_uid from current_fsuid() (Laszlo Ersek)   {CVE-2023-1076}
    - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela)   {CVE-2023-31436}
    - xen/netback: Fix buffer overrun triggered by unusual packet (Ross Lagerwall)   {CVE-2023-34319}
    - x86/pkeys: Revert a5eff7259790 ('x86/pkeys: Add PKRU value to init_fpstate') (Thomas Gleixner)  [Orabug:
    35714800]  {CVE-2022-40982}
    - Documentation/x86: Fix backwards on/off logic about YMM support (Dave Hansen)  [Orabug: 35714800]     {CVE-2022-40982}
    - x86/xen: Fix secondary processors' FPU initialization (Juergen Gross)  [Orabug: 35714800]     {CVE-2022-40982}
    - KVM: Add GDS_NO support to KVM (Daniel Sneddon)  [Orabug: 35714800]  {CVE-2022-40982}
    - x86/speculation: Add Kconfig option for GDS (Daniel Sneddon)  [Orabug: 35714800]  {CVE-2022-40982}
    - x86/speculation: Add force option to GDS mitigation (Daniel Sneddon)  [Orabug: 35714800]     {CVE-2022-40982}
    - x86/speculation: Add Gather Data Sampling mitigation (Daniel Sneddon)  [Orabug: 35714800]     {CVE-2022-40982}
    - x86/fpu: Move FPU initialization into arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]     {CVE-2022-40982}
    - x86/fpu: Mark init functions __init (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - x86/fpu: Remove cpuinfo argument from init functions (Thomas Gleixner)  [Orabug: 35714800]     {CVE-2022-40982}
    - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]     {CVE-2022-40982}
    - init: Invoke arch_cpu_finalize_init() earlier (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - init: Remove check_bugs() leftovers (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - um/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - sparc/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - sh/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - mips/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - m68k/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - ia64/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - ARM: cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - x86/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - init: Provide arch_cpu_finalize_init() (Thomas Gleixner)  [Orabug: 35714800]  {CVE-2022-40982}
    - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai)     {CVE-2023-31084}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-13043 advisory.

    - nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg)  [Orabug: 36028025]     {CVE-2023-5178}
    - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky)  [Orabug: 35857365]     {CVE-2023-5090}
    - netfilter: nf_tables: disallow rule removal from chain binding (Pablo Neira Ayuso) [Orabug: 35865117]     {CVE-2023-5197}
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (Jozsef Kadlecsik) [Orabug:
    35865151] {CVE-2023-42756}
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction (Pablo Neira Ayuso)     [Orabug: 35814389] {CVE-2023-4244}
    - netfilter: nf_tables: adapt set backend to use GC transaction API (Pablo Neira Ayuso) [Orabug: 35814389]     {CVE-2023-4244}
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814453] {CVE-2023-4921}
    - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924095]     {CVE-2023-45871}
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35923998]     {CVE-2023-42752}
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810514]     {CVE-2023-4623}
    - uek-rpm: Disable kernel support for CONFIG_FIREWIRE in OL9 (Yifei Liu)  [Orabug: 35493648]     {CVE-2023-3159}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-430 advisory.

    An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    x86: KVM: SVM: always update the x2avic msr interception (CVE-2023-5090)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow (CVE-2023-54069)

    A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation.

    If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it     can increment or write to memory locations outside of the allocated buffer.

    We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6502-4 advisory.

    Ivan D Barrera, Christopher Bednarz, Mustafa Ismail, and Shiraz Saleem discovered that the InfiniBand RDMA     driver in the Linux kernel did not properly check for zero-length STAG or MR registration. A remote     attacker could possibly use this to execute arbitrary code. (CVE-2023-25775)

    Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero     erasesize during device attachment. A local privileged attacker could use this to cause a denial of     service (system crash). (CVE-2023-31085)

    Manfred Rudigier discovered that the Intel(R) PCI-Express Gigabit (igb) Ethernet driver in the Linux     kernel did not properly validate received frames that are larger than the set MTU size, leading to a     buffer overflow vulnerability. An attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-45871)

    Maxim Levitsky discovered that the KVM nested virtualization (SVM) implementation for AMD processors in     the Linux kernel did not properly handle x2AVIC MSRs. An attacker in a guest VM could use this to cause a     denial of service (host kernel crash). (CVE-2023-5090)

    It was discovered that the SMB network file sharing protocol implementation in the Linux kernel did not     properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5345)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
201233	RHEL 8 : kernel (RHSA-2024:4211)	Nessus	Red Hat Local Security Checks	2024/7/2	2025/8/15	high
226163	Linux Distros Unpatched Vulnerability : CVE-2023-5090	Nessus	Misc.	2025/3/5	2026/7/17	medium
183083	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2023-12911)	Nessus	Oracle Linux Local Security Checks	2023/10/14	2026/2/9	high
239841	TencentOS Server 4: kernel (TSSA-2024:0960)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	critical
186962	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2023-13043)	Nessus	Oracle Linux Local Security Checks	2023/12/15	2026/2/9	high
185719	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-430)	Nessus	Amazon Linux Local Security Checks	2023/11/15	2026/2/10	high
186491	Ubuntu 22.04 LTS / 23.04 : Linux kernel vulnerabilities (USN-6502-4)	Nessus	Ubuntu Local Security Checks	2023/11/30	2026/6/3	critical

检测

插件搜索

high

medium

high

critical

high

high

critical